Cadmere

Privacy Policy

Cadmere ("we", "us") provides a lead-management and customer-communication platform for businesses. This policy explains what information we handle, how we use it, and the choices you have. It applies to the Cadmere platform at app.cadmere.ai.

Information we handle

• Account information — your business name, email address, and login credentials (passwords are stored and verified by our authentication provider; we never see them in plain text).
• Business data you enter — the leads, contacts, appointments, tasks, and reminder settings you or your customers create inside the platform.
• Google account data — if you choose to connect Gmail, we store an OAuth token that lets the platform send email on your behalf. See the next section.

How We Protect Your Data

We apply layered safeguards to keep your information — and your customers' — secure:

• Encryption in transit. The platform is served exclusively over HTTPS/TLS, and session cookies are marked Secure and HttpOnly, so your credentials and data never travel over an unencrypted connection.
• Encryption at rest. Your data is held in our managed database (Supabase / PostgreSQL), which encrypts data at rest. Database backups are encrypted with AES-256.
• Google tokens stay server-side. Your Google OAuth token is stored only on our servers, is never exposed to any browser or to any other customer, and is encrypted at rest with the rest of our database. It is used solely to send the emails you approve, and you can delete it at any time (see "Disconnecting and deletion").
• Strict tenant separation. Each business's data is isolated at the database level using row-level security access controls, so one customer can never read another customer's leads, contacts, tokens, or emails.
• Least privilege. We request only the minimum Google permission the product needs — gmail.send — and nothing that would let us read, search, or delete mail.
• Restricted administrative access. Administrative access to the systems that hold your data — our database, hosting, and Google Cloud project — is limited to the operator and protected by strong, unique passwords and two-factor authentication. Application secrets and keys live in server environment configuration, never in our source code.
• Monitoring and incident response. We monitor the platform for failures and security-relevant errors. If a data breach affecting you occurs, we will investigate promptly and notify you as required by applicable law.

Service Providers

We use a small number of trusted providers to run the service: Supabase (database hosting), Render (application hosting), Resend (transactional email), and a self-hosted automation service (n8n) that coordinates reminders, lead routing, and AI-assisted drafting. AI drafting is performed by Anthropic (Claude) on the minimum data needed (lead and CRM details) and is never used to train their models. Your connected Gmail is used only to send the messages you approve; your Gmail access tokens and mailbox data are never shared with the automation service or with any AI provider.

How We Use Google User Data

• Purpose. Your Google account access is used for a single purpose: to send the follow-up and reminder emails you configure. Customer-facing reminders are drafted for you and are sent only after you review and approve them.
• Sender. Email is always sent from your own connected Gmail address — we never send from an address you have not authorised.
• No secondary use. We do not sell Google user data, do not use it for advertising, and do not use it to train generalised artificial-intelligence or machine-learning models. No human reads your Google user data except with your explicit permission, where necessary to resolve a support request you raise, to maintain security, or where required by law.

Cadmere's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data sharing

We do not sell your data. We share it only with the service providers that operate the platform (for hosting, database, and email delivery), strictly to provide the service. Each business's data is isolated — one client can never access another client's leads, tokens, or emails.

Disconnecting and deletion

You can disconnect Gmail at any time from your dashboard (Reminders → Disconnect), which deletes the stored Google token from our systems. You can additionally revoke Cadmere's access from your Google Account's security settings. You may request deletion of your account and all associated data by emailing vedantkumar638@gmail.com, and we will remove it within 30 days, except where we must retain limited records to meet legal obligations.

Contact

Questions about this policy or your data? Email vedantkumar638@gmail.com.